Files
adebisi-fa 14f6fd6a8e feat(fpagent): authenticate the wizard's a2loft calls with the session token
The fingerprint wizard's staff-lookup and fingerprint-save proxies forwarded the page's OTP with the session phone. a2loft resolves that phone against the domain being addressed, so an operator who holds only capture_biometric was rejected unless they were a domain super-user. The cropper already saves with the session token.

- tools/server.js: both a2loft proxies send Authorization: Bearer <session token>, no phone/otp; validateProxy drops the OTP and phone checks.
- tools/public/assets/fp: both OTP fields, otpLookup/otpSave state, request params and resets removed; canLookup/canSave no longer gate on OTP.
- Tests assert the Bearer header, no query auth, no OTP field in the served page, and both gates without a credential (66/66 pass).
- README and Help page updated.

Requires the a2loft fingerprint-token-auth change deployed first. OpenSpec change: fingerprint-token-auth.
2026-10-02 20:41:43 +01:00

154 lines
4.9 KiB
JavaScript

// The /fingerprint wizard's scanner-availability logic. app.js is a browser
// IIFE, so it is loaded in a vm sandbox with stubbed browser globals and its
// Vue options are exercised directly (no Vue runtime needed).
import test from 'node:test';
import assert from 'node:assert/strict';
import fs from 'node:fs';
import vm from 'node:vm';
const SRC = fs.readFileSync(new URL('../public/assets/fp/app.js', import.meta.url), 'utf8');
function loadApp() {
let options = null;
let socket = null;
const els = {};
const document = {
getElementById(id) {
return (els[id] ||= {
textContent: '',
attrs: {},
setAttribute(k, v) { this.attrs[k] = v; },
getAttribute(k) { return this.attrs[k]; },
});
},
};
const sandbox = {
window: {
__SESSION__: { agentUrl: 'http://127.0.0.1:9000', domains: [] },
location: { href: '' },
},
document,
Vue: class Vue { static config = {}; constructor(o) { options = o; } },
io() {
socket = { handlers: {}, on(e, cb) { this.handlers[e] = cb; return this; } };
return socket;
},
setInterval: () => 0,
setTimeout: () => 0,
clearTimeout: () => {},
console,
};
vm.runInNewContext(SRC, sandbox);
return {
get options() { return options; },
get socket() { return socket; },
getElement: (id) => document.getElementById(id),
};
}
function makeVm(app) {
const o = app.options;
const inst = Object.assign({}, o.data);
for (const [k, fn] of Object.entries(o.methods)) inst[k] = fn.bind(inst);
for (const [k, fn] of Object.entries(o.computed)) {
Object.defineProperty(inst, k, { get: fn.bind(inst), configurable: true });
}
inst.$forceUpdate = () => {};
inst.loadSession();
inst.connectAgent();
return inst;
}
test('disconnected agent blocks capture and warns', () => {
const vmInst = makeVm(loadApp());
assert.equal(vmInst.captureReady, false);
assert.equal(vmInst.scannerNotice.title, 'Capture agent offline');
});
test('available:false blocks capture and warns; true re-enables', () => {
const app = loadApp();
const vmInst = makeVm(app);
const h = app.socket.handlers;
h.connect();
h['fprint-device-status']({ available: false, device: '' });
assert.equal(vmInst.captureReady, false);
assert.equal(vmInst.scannerNotice.title, 'Scanner not connected');
h['fprint-device-status']({ available: true, device: 'Digital Persona U.are.U' });
assert.equal(vmInst.captureReady, true);
assert.equal(vmInst.scannerNotice, null);
assert.equal(vmInst.agent.device, 'Digital Persona U.are.U');
});
test('unknown availability (old agent) does not block capture', () => {
const app = loadApp();
const vmInst = makeVm(app);
app.socket.handlers.connect();
assert.equal(vmInst.agent.available, null);
assert.equal(vmInst.captureReady, true);
assert.equal(vmInst.scannerNotice, null);
});
test('status tag reflects offline, connected, no-scanner and ready', () => {
const app = loadApp();
const vmInst = makeVm(app);
const h = app.socket.handlers;
const el = app.getElement('agent-status');
vmInst.renderAgentTag();
assert.equal(el.textContent, 'Agent offline');
assert.equal(el.getAttribute('type'), 'red');
h.connect();
assert.equal(el.textContent, 'Agent connected');
h['agent-hello']({ version: 'abc123', captureAgentId: 'aid' });
assert.equal(el.getAttribute('title'), 'fpagent abc123');
h['fprint-device-status']({ available: false });
assert.equal(el.textContent, 'Scanner not connected');
assert.equal(el.getAttribute('type'), 'red');
h['fprint-device-status']({ available: true, device: 'U.are.U 4500' });
assert.equal(el.textContent, 'Agent ready');
assert.equal(el.getAttribute('type'), 'green');
assert.match(el.getAttribute('title'), /abc123/);
assert.match(el.getAttribute('title'), /U\.are\.U 4500/);
});
test('capture is refused when no reader is attached', () => {
const app = loadApp();
const vmInst = makeVm(app);
const h = app.socket.handlers;
h.connect();
h['fprint-device-status']({ available: false });
vmInst.domain = 'uc';
vmInst.reference = 'UC/1';
vmInst.capture('right-thumb');
assert.equal(vmInst.capturing, null);
assert.equal(vmInst.notif.show, true);
});
test('lookup and save need no OTP credential', () => {
const vmInst = makeVm(loadApp());
vmInst.domain = 'uc';
vmInst.reference = 'UC/1';
assert.equal(vmInst.canLookup, true);
vmInst.fingers['right-thumb'].status = 'done';
vmInst.fingers['right-index-finger'].status = 'done';
assert.equal(vmInst.canSave, true);
});
test('disconnect clears availability', () => {
const app = loadApp();
const vmInst = makeVm(app);
const h = app.socket.handlers;
h.connect();
h['fprint-device-status']({ available: true, device: 'U.are.U' });
h.disconnect();
assert.equal(vmInst.agent.connected, false);
assert.equal(vmInst.agent.available, null);
assert.equal(vmInst.agent.device, '');
assert.equal(vmInst.captureReady, false);
});